Tag Archives: cybercriminals

News of high-profile cyber breaches has been uncharacteristically subdued in recent quarters. However, we recently learned that Marriott International/Starwood was the victim of the multi-year theft of personal information on up to 500 million customers — rivaled only by hacks against Yahoo in 2013 and 2014.

Is this a harbinger of a worse hacking landscape in 2019?

The answer is unequivocally yes. No question, cyber breaches have been a gigantic thorn in the global economy for years. But expect them to be even more rampant in the new year as chronically improving malware will be deployed more aggressively on more fronts.

In addition, as companies increasingly pursue digitization to drive efficiency, reduce costs and build data-driven businesses, they simultaneously move into the “target zone” of cyber attacks. As the digital economy expands, the threat landscape naturally follows suit. Compounding the situation is the use of machine learning and AI as hackers and other bad actors look to scale their bad behavior.

Look for AI-driven chatbots to go, rogue, a substantial increase in crimeware-as-a-service, acceleration of the weaponization of data, a resurgence in ransomware and a significant increase in nation-stage cyberattacks. Also on a growth track is so-called cryptojacking — a quiet, more insidious avenue of profit that relies on invasive methods of initial access and drive-by scripts on websites to steal resources from unsuspecting victims.

Then, too, we will also see a substantial increase in software subversion, including the specific targeting of developers for attack and the likely proliferation of software update supply chain attacks. Here is a mini dive into the top pending threats:

The emergence of AI-driven chatbots. In the new year, cybercriminals and black hat hackers will create malicious chatbots that try to socially engineer victims into clicking links, downloading files or sharing private information. A hijacked chatbot could easily misdirect victims to nefarious links rather than legitimate ones. Attackers are also likely to leverage web application flaws in legitimate websites to insert a malicious chatbot into a site that doesn’t have one.

Attacks on cities with crimeware-as-a-service, a new component of the underground economy. Adversaries will leverage new tools that among other things attack data integrity, disabling computers to the point of requiring mandatory hardware replacements. Terrorist-related groups will be the likely culprits.

A significant increase in nation-state attacks. Russia has been a leader in using targeted cyberactions as part of larger objectives. Earlier this year, for example, the FBI disclosed that Sofacy group, a Russian persistent threat actor, infected more than 500,000 home office routers and network attached to storage devices worldwide to remote control them. Look for other nation-states to follow the same sort of playbook, helped by billions of poorly secured IoT devices.

The growing weaponization of data. Already a huge problem, it is certain to worsen, notwithstanding efforts among some technology giants to enhance user security and privacy. Balancing the negatives with the positives, tens of millions of comprised web users have begun to seriously question how much they really benefit from the internet.

Consider, for example, Facebook, which has made no secret of using personal data and “private” correspondence to annually generate billions of dollars in profits. Users willingly “like” interests and brands, volunteering personal information. This enables Facebook to provide a more complete image of its user base — a gold mine for advertisers.

Much worse, Facebook earlier this year tried to manipulate user moods through an “emotional contagion” experiment. This pitted users against their peers to influence their emotions, i.e. the weaponization of data.

A resurgence in ransomware. Ransomware exploded onto the scene in 2017 following the WannaCry outbreak and a series of successful follow-up ransomware attacks targeting high-profile victims. According to the FBI, total ransomware payments in the U.S. have in some years exceeded $1 billion. There were scant high-profile ransomware victims in recent months, but the problem is highly likely to bounce back strongly in 2019. Ransomware attacks come in waves, and the next one is due.

Increased subversion of software development processes and attacks on software update supply chains. Regarding software development, malware has already been detected in select open-source software libraries. Meanwhile, software update supply chain attacks violate software vendor update packages. When customers download and install updates, they unwittingly introduce malware into their system. In 2017, there was an average of one attack every month, compared to virtually none in 2016, according to Symantec. The trend continued in 2018 and will become worse next year.

More cyber attacks on satellites. In June, Symantec reported that an unnamed group had successfully targeted the satellite communications of Southeast Asia telecom companies involved in geospatial mapping and imaging. Symantec also reported attacks originating in China last year on a defense contractor’s satellite.

Separately, we learned in August at the annual Black Hat information security conference that the satellite communications used by ships, planes and the military to connect to the internet are vulnerable to hackers. In the worst-case scenario, the research said, hackers could carry out “cyber-physical attacks” that could turn satellite antennas into weapons that essentially operate like microwave ovens. Fortunately, the cyber outlook for 2019 is not altogether grim.

On the cybersecurity side, a growing number of experts believe that multi-factor authentication will become the standard for all online businesses, abandoning password-only access. In addition, a number of states are expected to adopt some version of Europe’s strict General Data Protection Legislation. California, for one, has already passed legislation that will make it easier for consumers to sue companies after a data breach, starting in 2020. The upshot is that individuals, businesses and government entities need to do everything possible to improve the state of their cybersecurity. They cannot eliminate breaches, but they can avert some and improve the chances of mitigating them.

Security researchers have discovered yet another example of how cybercriminals disguise their malware activities as regular traffic by using legitimate cloud-based services.

Trend Micro researchers have uncovered a new piece of malware that retrieves commands from memes posted on a Twitter account controlled by the attackers.

Most malware relies on communication with their command-and-control server to receive instructions from attackers and perform various tasks on infected computers.

Since security tools keep an eye on the network traffic to detect malicious IP addresses, attackers are increasingly using legitimate websites and servers as infrastructure in their attacks to make the malicious software more difficult to detect.In the recently spotted malicious scheme, which according to the researchers is in its early stage, the hackers uses Steganography—a technique of hiding contents within a digital graphic image in such a way that’s invisible to an observer—to hide the malicious commands embedded in a meme posted on Twitter, which the malware then parses and executes.

Although the internet meme looks a normal image to human eyes, the command “/print” is hidden in the file’s metadata, which then prompts the malware to send a screenshot of the infected computer to a remote command-and-control server.

Here, the malware, which the researchers named “TROJAN.MSIL.BERBOMTHUM.AA,” has been designed to check the attacker’s Twitter account and then download and scan meme (image) files for the secret commands.

According to the Trend Micro researchers, the Twitter account in question was created in 2017 and contained only two memes posted on October 25 and 26 that delivered “/print” commands to the malware that instructed it to take screenshots.

The malware then sends the screenshots to a command and control server, whose address is obtained through a “hard-coded” URL on the Pastebin site.

Besides taking screenshots, the malware can also be given a variety of other commands, such as to retrieve a list of running processes, grab the account name of the logged in user, get filenames from specific directories on an infected machine, and grab a dump of the user’s clipboard. The malware appears to be in the early stages of its development as the pastebin link points to a local, private IP address, “which is possibly a temporary placeholder used by the attackers.”

It’s worth noting that the malware was not downloaded from Twitter itself and the researchers currently haven’t found what specific mechanism that was or could be used by attackers to deliver the malware to the victims’ computers. The good news is that the Twitter account used to deliver the malicious memes appears to have been disabled, but it is still not clear who is behind this malware and how the mysterious hacker was circulating the malware.